Stronger locks for our digital future
The systems supporting education, healthcare, research, finance, public services and critical infrastructure are protected by digital identities. When attackers compromise an account, they may use it to steal information, impersonate the account owner, send phishing messages, redirect payments or access additional systems.
As we work toward “Securing the Next 250,” protecting each digital identity is an essential part of building a secure and resilient future.
Password Length Matters
Attackers use automated tools to test large numbers of passwords. Short, common or predictable passwords can be guessed quickly.
A strong password should be:
- Long
- Unique to the account
- Difficult to guess
- Unrelated to publicly available personal information
- Where possible, stored securely in a password manager
A longer passphrase made from unrelated words can be easier to remember and more difficult to guess than a short, complicated password.
Avoid using:
- Your name or username
- Family or pet names
- Birthdays or anniversaries
- University names or references
- Common keyboard patterns
- The current season or year
- Minor variations of an old password
Adding a number or symbol to a predictable password does not necessarily make it strong.
Never Reuse Passwords
Password reuse allows one compromised website to place other accounts at risk. Attackers often take passwords exposed in previous breaches and test them against email, financial, social media, and workplace accounts.
Every account should have a unique password. At minimum, your university password should never be reused for a personal account.
Use a Password Manager
A password manager can:
- Generate strong passwords.
- Store unique passwords securely.
- Reduce the need to memorize many credentials.
- Help identify reused or weak passwords.
- Reduce the likelihood of entering credentials on an unfamiliar website.
Multifactor Authentication Adds Another Layer
Multifactor authentication, commonly called MFA, requires more than one form of verification. It combines two or more of the following:
- Something you know, such as a password
- Something you have, such as a phone or security key
- Something you are, such as a fingerprint or face scan
MFA can stop many account compromises even when an attacker knows the password. Not all MFA methods provide the same level of protection, however. Security keys, passkeys, certificate-based authentication and correctly implemented number matching provide stronger protection than basic text-message codes or phone calls.
Defend Against MFA Fatigue
Attackers sometimes send repeated authentication requests hoping that the user will approve one to stop the notifications. This is called MFA fatigue or MFA bombing.
If you receive an unexpected authentication prompt:
- Do not approve it.
- Select the option to deny or report the request, if available.
- Contact the Help Desk.
- Change your password if instructed by the IT team.
- Review your account activity with the IT security team.
Never share an MFA verification code with another person. A legitimate support representative should not ask you to read an authentication code to them.
Wrap Up
If you have any further questions about your NEOMED account or MFA, please reach out to the Help Desk. Likewise, if you have any questions in general, please don’t hesitate to ask the NEOMED IT team as we are here to help. For guidance on NEOMED MFA and how to configure and use each option, please see our MFA Knowledge Base section.